CVE-2026-82227 HIGH

CVE-2026-82227: WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability

Vendor Villatheme
Product WPBulky
Weakness CWE-89 · SQLi
Published August 28, 2026
Last update August 28, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Contributor SQL Injection in WPBulky <= 1.2.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WPBulky versions up to 1.2.2 contain a SQL injection vulnerability that allows authenticated users to query the database directly. An attacker with low-level site access can extract sensitive data or disrupt database operations. The vulnerability requires valid login credentials but no additional user interaction.

What an attacker can do

03Attacker Capabilities

Extract sensitive data from the database or cause database errors and service disruption.

Potential impact on your site

04Site Impact

Unauthorized database access and potential data breach for any site running WPBulky ≤1.2.2 with untrusted user accounts.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges on the site.

Key dates

06Disclosure timeline

August 28, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-73187 WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability CVE-2026-12248 WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter CVE-2026-28156 WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability CVE-2026-61969 WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability